Implement SAML authentication for GL3 #5476
Conversation
|
Thanks for these PR's - I will definitely keep these open and will mark them as |
|
@farhatahmad Thank you, that's great. FYI: I have made another PR #5480 , which is a subset of this one here. It is designed to be easily mergeable and lessen the burden of maintaining custom provider extensions. Please let me know your thoughts on that one. |
This comment was marked as duplicate.
This comment was marked as duplicate.
Sorry, something went wrong.
| # Re-write LDAP and Google to greenlight | ||
| user_hash[:provider] = %w[greenlight ldap google openid_connect].include?(user_hash[:provider]) ? 'greenlight' : user_hash[:provider] | ||
| # Re-write list of providers to greenlight | ||
| user_hash[:provider] = %w[greenlight ldap google openid_connect saml].include?(user_hash[:provider]) ? 'greenlight' : user_hash[:provider] |
There was a problem hiding this comment.
Now that SAML is in this list, the V2 migration task should work without modification. Beforehand I had a modification in place which did match the provider to greenlight already in the migration task.
Ithanil
force-pushed
the
saml
branch
2 times, most recently
from
43bb040
to
80b81c2
Compare
|
Kudos, SonarCloud Quality Gate passed!
|
|
|
|
|
Common vulnerability with ruby projects implementing SAML: https://ssoready.com/blog/engineering/ruby-saml-pwned-by-xml-signature-wrapping-attacks/ (Not a dev - can't say if this implementation is affected) |
Many thanks for the heads-up. Indeed, it appears as if this PR is implementation is affected. I will update the branch later, bumping omniauth-saml to 2.2.1 and ruby-saml to 1.17.0. EDIT: Fixed by 8eb2638 |
|
This PR enables SAML authentication for GL3 and is based on similar PRs for GL2: #1334 and #2270 . We are using this feature in production, but it was not developed with the goal to be merged upstream. Because SAML for GL2 was never merged, I guess it won't happen for GL3 as well. However, I'd like to provide our development to the public for anyone in need of this.
This is the part of a series of similar PR submissions (Redis Sentinel, SAML integration, LDAP integration).
Details / How to use: